When connecting to the MQTT broker, hm2mqtt logs the full broker connection string at INFO level, including embedded credentials:
Connecting to MQTT broker at mqtt://<username>:<password>@<host>:<port> with client ID <clientId>
This comes from src/mqttClient.ts line 50:
`Connecting to MQTT broker at ${this.config.brokerUrl} with client ID ${this.config.clientId}`,Since brokerUrl can include username:password@host:port (as documented in the README, e.g. mqtt://username:password@host:1883), the password ends up in plaintext in application logs — at INFO level, not just DEBUG, so it's not something a user can avoid by lowering log verbosity. In containerized/addon environments (e.g. the Home Assistant add-on) these logs are often persisted, viewed via a web UI, or shared for troubleshooting, which makes this an easy way to accidentally leak a broker password.
Suggested fix: strip or mask the userinfo portion of the URL before logging it, e.g. via new URL(brokerUrl) and clearing .username/.password, or a simple regex replacing user:pass@ with ***@.
When connecting to the MQTT broker, hm2mqtt logs the full broker connection string at INFO level, including embedded credentials:
This comes from
src/mqttClient.tsline 50:Since
brokerUrlcan includeusername:password@host:port(as documented in the README, e.g.mqtt://username:password@host:1883), the password ends up in plaintext in application logs — at INFO level, not just DEBUG, so it's not something a user can avoid by lowering log verbosity. In containerized/addon environments (e.g. the Home Assistant add-on) these logs are often persisted, viewed via a web UI, or shared for troubleshooting, which makes this an easy way to accidentally leak a broker password.Suggested fix: strip or mask the userinfo portion of the URL before logging it, e.g. via
new URL(brokerUrl)and clearing.username/.password, or a simple regex replacinguser:pass@with***@.